Dutch DPA fines Uber EUR 824 990 000 for unlawful automated decision-making and insufficient information on profiling

What happened

The Autoriteit Persoonsgegevens imposed a €824,990,000 administrative fine on Uber for violating the GDPR prohibition on fully automated decision‑making and for failing to inform drivers about profiling. The violations stemmed from automatic temporary or permanent deactivation of driver accounts based on fraud suspicions or low customer ratings from 2018 to 2022. Complaints by 171 French drivers triggered the investigation under the GDPR One‑Stop‑Shop procedure. Uber has ceased the offending practices but has appealed the fine, and no final judicial decision has been made.

Why it matters

Ride‑hailing platforms that use algorithmic driver deactivation must audit their automated decision systems and ensure transparent notices to avoid similar penalties.

Business impact

Companies will need to redesign deactivation workflows to include human review and update privacy notices, potentially incurring legal and technical costs.

Checklist

• Audit automated decision processesHigh priority

  Identify any fully automated actions affecting drivers and assess GDPR compliance.

• Add transparent information on profilingHigh priority

  Update privacy notices to clearly explain automated decision logic and driver rights.

• Implement human oversightHigh priority

  Introduce manual review steps before permanent deactivation of driver accounts.

• Document compliance measuresMedium priority

  Maintain records of the audit, notices, and oversight mechanisms for regulator review.

Who reported it

Discussion